EUVD-2006-7220

Malware in sbrugna...

EUVD-2021-23354

Malware in sbrugna...

EUVD-2006-4469

Malware in sbrugna...

EUVD-2025-20784

Malicious code in bioql PyPI...

CVE-2025-6742

Mode C: CVE-2025-6742 affects the WordPress plugin SureForms – Drag and Drop Form Builder for WordPress up to version 1.7.3. The root cause is use of file_exists() in delete_entry_files() with no path restriction, enabling unauthenticated PHP Object Injection. The report notes that no known POP c...

PHAR deserialization allowing remote code execution

Description snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitra...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2006-7243

PHP before 5.3.4 accepts a NUL (\0) in a pathname, enabling context-dependent bypass of access restrictions (example: .php\0.jpg) via file_exists; remediation involves upgrading to a fixed PHP version (5.3.4+; later advisories note 5.4.41+/5.5.x+/5.6.x fixes). The CVE-2015-4025/4026 entries ackno...

CVE-2006-7243

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the fileexists function...

Arbitrary file deletion

PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the php121dir parameter, which is accessed by the fileexists function...

CVE-2006-6043

PHP file inclusion vulnerability in loginform-inc.php in Oliver formerly Webshare 1.2.2 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the confmotdfile parameter, which is accessed by the...

PHP多个安全漏洞.

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP中存在多个安全漏洞，具体如下： 1 fileexists、imapopen和imapreopen函数中缺少safemode和openbasedir验证； 2 在64位系统上strrepeat和wordwrap函数存在边界错误； 3 可通过cURL扩展和realpath缓存绕过openbasedir和safemode保护机制； 4 GD扩展处理畸形GIF图形时存在边界条件错误； 5 stripos函数中的错误可能导致界外内存读取； 6 64位系统上存在错误的memorylimit限制。...

CVE-2006-1839

PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the datadir parameter, which satisfies the fileexists function call...

Remote file inclusion

PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the datadir parameter, which satisfies the fileexists function call...

CVE-2006-1839

PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when registerglobals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the datadir parameter, which satisfies the fileexists function call...